CVE-2026-8972

The WebRTC: Audio/Video component in the Mozilla Firefox web browser and Mozilla Thunderbird email client is affected by a privilege escalation vulnerability caused by insecure privilege management . A remote attacker could exploit this flaw to cause service interruptions or achieve elevated priv...

CVE-2026-92071

A sandbox escape vulnerability exists in the Widget: Win32 component of Firefox and Thunderbird due to incorrect boundary conditions. This flaw allows an attacker to escape the sandbox environment, potentially leading to broader system impact. The issue was addressed in Firefox 156 , Firefox ESR ...

CVE-2005-4809

CVE-2005-4809 affects Mozilla Firefox 1.0.1 (and possibly other Mozilla products such as Mozilla and Thunderbird) and describes a UI spoofing issue where an attacker can spoof the URL shown in the Status Bar. The root cause is a crafted A HREF tag that includes a TABLE tag containing another A ta...

CVE-2006-3731

Firefox 1.5.0.4 and earlier is vulnerable: remote, user-assisted crash via a form using multipart/form-data with a user-uploaded file. The root cause is not detailed in the provided documents; no remediation steps are stated. Note also the issue has been linked to a third-party claim about the Li...

CVE-2008-2419

The vulnerability CVE-2008-2419 affects Mozilla Firefox 2.0.0.14 . It arises from an error condition during certain Iframe operations between a JSframe write and a JSframe close , which can cause heap corruption and an application crash and may allow remote arbitrary code execution . Reported imp...

CVE-2014-1566

CVE-2014-1566 affects Mozilla Firefox on Android (before 31.1). Affected component: processing of file: URLs allows a crafted application to copy local files to the SD card and exfiltrate data from the Firefox profile directory. Root cause noted as an incomplete fix for CVE-2014-1515. Impact desc...

CVE-2015-7327

Technical details about CVE-2015-7327 are not publicly available in the provided connected documents. The initial description provides context but lacks specific vendor/product/version/root cause/impact. Monitor for updates and forthcoming advisories.

CVE-2025-14324

CVE-2025-14324 describes a JIT miscompilation in the JavaScript Engine’s JIT component affecting Firefox < 146, Firefox ESR < 115.31 and < 140.6, and Thunderbird

CVE-2025-6428

Mozilla Firefox for Android is vulnerable to an open redirect vulnerability. The issue occurs when the browser processes a querystring parameter containing a link; instead of following the intended destination, the browser follows the URL provided in the query string. This flaw can be exploited b...

CVE-2025-8042

Mozilla Firefox for Android is vulnerable to an information disclosure flaw in versions prior to 141 . The root cause is a sandboxed iframe that lacks the allow-downloads attribute but can still initiate downloads, allowing a remote attacker to bypass security restrictions and obtain sensitive in...

CVE-2026-16378

Other issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-16397

Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153.

CVE-2026-2764

CVE-2026-2764: JIT miscompilation, use-after-free in the JavaScript Engine: JIT component. Affected products include Firefox/Firefox ESR (pre-148 and ESR

CVE-2026-2798

A use-after-free vulnerability exists in the DOM: Core & HTML components of the Mozilla Firefox web browser and Mozilla Thunderbird email client. This flaw allows for the reuse of memory after it has been freed, which can be exploited by a remote attacker to trigger service interruptions or failu...

CVE-2026-4694

CVE-2026-4694: A vulnerability in the Graphics component (incorrect boundary conditions, integer overflow) affecting Firefox and Firefox ESR releases prior to 149/115.34 and 140.9. Patches are available in Firefox 149 and ESR 115.34, ESR 140.9. Other connected advisories reiterate related Firefox...

CVE-2026-84120

A use-after-free vulnerability exists in the Audio/Video component of Mozilla Firefox and Thunderbird . This flaw could potentially allow for the execution of arbitrary code , sandbox escape , or privilege escalation . The issues have been addressed in Firefox 155 , Firefox ESR 115.40 , Firefox E...

CVE-2026-8963

The Firefox web browser and Thunderbird email client are vulnerable to a spoofing issue within the Web Speech component. This flaw allows an attacker to bypass authentication through spoofing, potentially leading to a compromise of data integrity . The vulnerability has been addressed in Firefox ...

CVE-2026-8969

The Firefox web browser and Thunderbird email client are affected by a mitigation bypass in the DOM: Security component. The root cause is a lack of adequate data security mechanisms, which could allow a malicious actor to access confidential data and compromise its integrity . This vulnerability...

CVE-2006-6585

CVE-2006-6585 affects Mozilla Firefox 2.0, with the Extensions Manager not correctly populating the local extensions list. This enables an attacker to craft an extension that hides itself by locating its name in the list and invoking RemoveElement, as demonstrated by the FFsniFF extension; later ...

CVE-2008-7244

The CVE-2008-7244 entry covers Mozilla Firefox 3.0.1 and earlier, where a remote attacker can cause a denial of service by repeatedly invoking window.print in a loop (a printing DoS). This document notes the vulnerability affects Firefox and is related to the issue tracked as CVE-2009-0821 (neste...

CVE-2017-7770

CVE-2017-7770 describes a spoofing vulnerability in Firefox for Android: when a new tab is loaded via JavaScript events and fullscreen is entered, the address bar may not be rendered, allowing a malicious site to spoof the displayed URL. Affected: Firefox for Android, Firefox

CVE-2025-10532

Mozilla Firefox , Firefox ESR , and Thunderbird are vulnerable to a security bypass due to incorrect boundary conditions in the JavaScript: GC component . The root cause is identified as insufficient checking of unusual or exceptional states within the GC functions. Successful exploitation could ...

CVE-2025-11708

A Use-after-free vulnerability exists in the MediaTrackGraphImpl::GetInstance() function within Mozilla Firefox , Firefox ESR , and Thunderbird . This memory safety issue allows a malicious actor to execute arbitrary code . The vulnerability affects Firefox < 144 , Firefox ESR < 140.4 , Thu...

CVE-2025-8043

Mozilla Firefox and Thunderbird are vulnerable to a security flaw where URLs are incorrectly truncated toward the beginning instead of around the origin. This vulnerability exists in products earlier than version 141 . Potential impacts include security bypass , spoofing the user interface , and ...

CVE-2026-12301

A memory safety bug exists in the Mozilla Firefox web browser and Thunderbird email client. The vulnerability involves operations escaping buffer boundaries in memory, which could allow a remote attacker to gain access to confidential data . This issue is addressed in Firefox 152 and Thunderbird ...

CVE-2026-12303

The Firefox web browser and Thunderbird email client are affected by an information disclosure vulnerability in the Graphics: WebGPU component. The root cause is incorrect boundary conditions , which allows an attacker to read data from buffer areas beyond the allowed limits and potentially acces...

CVE-2026-4689

CVE-2026-4689: A sandbox-escape issue caused by incorrect boundary conditions and an integer overflow in the XPCOM component. Public disclosures across multiple sources show affected products include Firefox and Thunderbird (various release tracks), with fixes implemented in Firefox 149, ESR 115....

CVE-2026-9309

The Firefox for iOS Reader View fails to properly escape HTML tags in JSON-LD metadata , allowing a malicious page to inject markup. This injection can alter Reader View behavior and leak sensitive URL parameters , which may be leveraged to access internal pages. This could potentially result in ...

CVE-2006-6506

CVE-2006-6506 affects Mozilla Firefox 2.0 up to, but not including, 2.0.0.1. The vulnerability arises from the Feed Preview feature where requesting favicon.ico icons leaks the feed URL, enabling feed viewing services to infer browsing habits (privacy leak). The issue is tied to the RSS feed prev...

CVE-2007-3072

CVE-2007-3072 describes a directory traversal vulnerability in Mozilla Firefox before 2.0.0.4 on Windows. The issue allows a remote attacker to read arbitrary files via dot-dot-encoded backslash sequences ("..%5C") in a resource:// URI, leading to complete confidentiality impact . The NVD entry l...

CVE-2011-2368

The CVE-2011-2368 entry describes a WebGL write restriction flaw in Mozilla Firefox 4.x–4.0.1 that could allow remote code execution or a crash via unspecified vectors. Connected documents corroborate Firefox-focused WebGL/memory issues and reference MFSA2011-26. The OpenVAS/PTSecurity advisories...

CVE-2011-2668

Mozilla Firefox 1.5.0.3 and earlier contains a vulnerability in processing the content-length header that can allow script injection from another domain when viewing a malicious page. Affected product: Mozilla Firefox (pre-1.5.0.4). Root cause: improper handling of the content-length header. Impa...

CVE-2013-1727

CVE-2013-1727 affects Mozilla Firefox on Android prior to 24.0, where a symlink/URL trick can bypass the Same-Origin Policy for local files (file: URLs). This enables potential cross‑site scripting (XSS) and access to sensitive data such as cookies or passwords if a local file is involved. The is...

CVE-2013-1731

Mozilla Firefox for Android before 24.0 is affected by an untrusted search path vulnerability in the GL tracing functionality. An attacker could execute arbitrary code by placing a Trojan horse .so library in a world-writable directory that Firefox loads, enabling code execution. This CVE is corr...

CVE-2014-1515

CVE-2014-1515 affects Mozilla Firefox for Android prior to 28.0.1. It occurs when processing a file: URL by copying a local file to the SD card, allowing an attacker with a crafted application to read sensitive data from the Firefox profile directory. CVSSv2 base score 1.9 (LOW) with LOCAL access...

CVE-2014-1516

CVE-2014-1516 affects Mozilla Firefox for Android (up to version 28.0.1) where the saltProfileName in GeckoProfileDirectories.java relies on Android’s weak Math.random seeding, enabling a crafted application to bypass the profile-randomization protection. The vulnerability arises from weak random...

CVE-2025-11712

Mozilla Firefox , Firefox ESR , and Thunderbird are affected by CVE-2025-11712 , where a malicious page can use the type attribute of an OBJECT tag to override default browser behavior when encountering a web resource served without a content-type header. This flaw could lead to Cross-Site Script...

CVE-2025-11720

Summary of CVE-2025-11720 : The issue affects Mozilla Firefox (including Firefox for Android) where the Custom Tabs UI only shows the base site hostname, not the full hostname. This can enable user deception when content from a subdomain is hosted to resemble content from another subdomain of the...

CVE-2026-0886

Mozilla Firefox , Firefox ESR , and Thunderbird are affected by a vulnerability in the Graphics component caused by incorrect boundary conditions . This flaw can lead to memory operations outside of the buffer , potentially allowing a remote attacker to compromise the confidentiality of protected...

CVE-2026-92007

The Graphics: CanvasWebGL component in Mozilla Firefox and Thunderbird is vulnerable to privilege escalation due to incorrect boundary conditions. This vulnerability affects various versions of the software, including Firefox 156 , Firefox ESR 115.41 , Firefox ESR 140.16 , Firefox ESR 153.3 , Thu...

CVE-2026-92012

Mozilla Firefox and Thunderbird are affected by CVE-2026-92012, a privilege escalation vulnerability caused by incorrect boundary conditions within the Graphics: CanvasWebGL component. The vulnerability has been addressed in the following versions: Firefox 156, Firefox ESR 115.41, Firefox ESR 140...

CVE-2026-92017

CVE-2026-92017 is a privilege escalation vulnerability affecting the DOM: Service Workers component in Mozilla Firefox and Thunderbird . The issue was addressed in Firefox versions 156 , ESR 115.41 , ESR 140.16 , and ESR 153.3 , along with corresponding Thunderbird versions. No specific root caus...

CVE-2026-92062

CVE-2026-92062 is a privilege escalation vulnerability affecting the Session Restore component in Mozilla Firefox and Thunderbird . The flaw allows an attacker to gain elevated privileges on a system. Remediation is available in the following versions: Firefox 156 , Firefox ESR 153.3 , Thunderbir...

CVE-2004-1753

The CVE-2004-1753 issue affects the Apple Java plugin used by Netscape 7.1/7.2, Mozilla 1.7.2, and Firefox 0.9.3 on MacOS X 10.3.5. The vulnerability stems from improper handling of SetWindow(NULL) calls when tabbed browsing is enabled, allowing Java applets from one tab to draw to other tabs and...

CVE-2007-1736

Summary: CVE-2007-1736 affects Mozilla Firefox 2.0.0.3, where URLs embedded in (1) object and (2) iframe HTML tags are not checked against the phishing site blacklist, allowing bypass of phishing protection. The known description documents this condition as a vulnerability in the browser’s phishi...

CVE-2007-3074

CVE-2007-3074 affects Mozilla Firefox 2.0.0.4 and earlier, allowing a remote attacker to read files in the local Firefox installation directory via a resource:// URI. The NVD entry lists a CVSS v2 base score of 4.3 (Medium) with network attack vector, no authentication required, and partial confi...

CVE-2007-5415

CVE-2007-5415 describes an XSS in Mozilla Firefox 2.0 where UTF-7 document content rendered in UTF-7 allows remote attackers to inject arbitrary script/HTML via a gopher: URI using '/' to delimit a literal string within an XSS sequence. A related issue is CVE-2007-5414 (single-quote delimiter). T...

CVE-2011-0082

The CVE-2011-0082 entry concerns Mozilla Firefox 4.0.x–4.0.1 where the X.509 certificate validation does not properly implement single-session security exceptions. This could allow user-assisted remote attackers to spoof an SSL server using an untrusted certificate and trigger potentially unwante...

CVE-2011-2598

CVE-2011-2598 affects Mozilla Firefox 4.x WebGL implementation. The vulnerability allows remote attackers to obtain screenshots of the windows of arbitrary desktop applications via vectors involving an SVG filter, an IFRAME element, and uninitialized data in graphics memory. Connected sources con...

CVE-2013-1729

CVE-2013-1729 affects Mozilla Firefox WebGL on Mac OS X when using NVIDIA graphics drivers. It is an information-disclosure vulnerability: reading from a CANVAS element can allow remote attackers to obtain desktop-screenshot data. Documented in multiple feeds (SUSE, Fedora/NASL, OpenVAS) with a f...